rea-agents 6.4.0 → 6.7.0

package/dist/domain/javascript/javascriptStaticAnalysisCalls.js

@@ -1,40 +1,74 @@
 import * as t from "@babel/types";
+import { isIntrinsicMapLookup } from "./javascriptSemanticMapOperations.js";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { htmlUrlText, stripQueryAndFragment } from "../artifactPathSyntax.js";
 import { sanitizeEndpointCandidate } from "../browserObservation.js";
 import { addFindingOnce, addLocatedFinding, } from "./javascriptStaticAnalysisFindings.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
-import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { STATIC_ROUTE_CALL_NAMES, argumentNode, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName, unwrapJavaScriptExpression, } from "./javascriptAstValues.js";
+import { resolveSemanticBindingState, semanticStableInitializer, } from "./javascriptSemanticState.js";
+import { isUnmodifiedGlobalReference, isUnmodifiedImportMetaUrl, } from "./javascriptSemanticAmbientWrites.js";
+import { evaluateSemanticExpression, evaluateSemanticExpressionProvenance, } from "./javascriptSemanticValues.js";
+import { semanticTopLevelEffectFollowsCapture } from "./javascriptSemanticMutationInitializers.js";
+import { semanticFactoryLoaderMemberAt, semanticFactoryRequireLoaderAt, semanticRequireLoaderAt, } from "./javascriptSemanticRequireOrigin.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
-export const inspectCall = (source, node, context) => {
+export const inspectCall = (source, node, context, bindings) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
-    const module = context.accumulator.moduleRangeIndex.find(node.start);
-    const moduleRequireName = module?.requireName ?? null;
-    const requireCall = requireCallSpecifier(node, name, moduleRequireName);
+    const requireCall = requireCallSpecifier(node, bindings, context);
     if (requireCall !== null)
         addReference(context, {
             node,
             kind: "require",
             specifier: requireCall.specifier,
         });
-    const chunkLoad = chunkLoadSpecifier(node, name, moduleRequireName);
+    const chunkLoad = chunkLoadSpecifier(node, bindings, context);
     if (chunkLoad !== null)
         addReference(context, {
             node,
             kind: "dynamic-import",
             specifier: chunkLoad.specifier,
         });
-    for (const specifier of vitePreloadDependencySpecifiers(source, node, name))
+    for (const specifier of vitePreloadDependencySpecifiers(node, name, context.vitePreloadDependencyTable, bindings))
         addReference(context, { node, kind: "dynamic-import", specifier });
-    if (name === "Worker" || name.endsWith(".Worker"))
-        addReference(context, { node, kind: "worker", specifier: first });
-    if (name.endsWith("serviceWorker.register"))
-        addReference(context, { node, kind: "service-worker", specifier: first });
-    inspectEndpointCall(node, name, first, context);
+    const worker = t.isNewExpression(node) ? node : undefined;
+    const workerConstructor = worker === undefined
+        ? undefined
+        : workerConstructorKind(worker.callee, bindings);
+    if (workerConstructor !== undefined ||
+        name === "Worker" ||
+        name.endsWith(".Worker"))
+        addReference(context, {
+            node,
+            kind: "worker",
+            // A string path is relative to the document base URL in a browser and
+            // to the process cwd in Node; the analyzed source's artifact location
+            // establishes neither. Only `new URL(path, import.meta.url)` names a
+            // location relative to this module.
+            specifier: workerConstructor === undefined || worker === undefined
+                ? undefined
+                : moduleUrlSpecifier(worker, bindings),
+        });
+    // Service worker strings also use the document base URL. The complete called
+    // path must retain its platform identity, including the register method.
+    if (!t.isNewExpression(node) &&
+        isUnmodifiedGlobalReference(node.callee, bindings, [
+            "navigator",
+            "serviceWorker",
+            "register",
+        ]))
+        addReference(context, {
+            node,
+            kind: "service-worker",
+            specifier: moduleUrlSpecifier(node, bindings),
+        });
+    inspectEndpointCall(node, name, first, context, bindings);
     inspectStorageCall(node, name, first, context);
     if (first === "audio" || first === "video")
         noteMediaElementPreloads(node, accumulator);
-    if (name.endsWith("loadFile") && first !== undefined)
+    if ((name === "loadFile" || name.endsWith(".loadFile")) &&
+        first !== undefined)
         addLocatedFinding(context, {
             collection: accumulator.roles,
             key: `role\0renderer\0${first}`,
@@ -48,7 +82,7 @@ export const inspectCall = (source, node, context) => {
                 location: range(node),
             },
         });
-    if (name.endsWith("loadURL") && first !== undefined)
+    if ((name === "loadURL" || name.endsWith(".loadURL")) && first !== undefined)
         addLocatedFinding(context, {
             collection: accumulator.roles,
             key: `role\0renderer\0${first}`,
@@ -63,6 +97,62 @@ export const inspectCall = (source, node, context) => {
             },
         });
 };
+const moduleUrlSpecifier = (call, bindings) => {
+    const argumentExpression = argumentNode(call.arguments[0]);
+    if (argumentExpression === undefined)
+        return undefined;
+    const node = unwrapJavaScriptExpression(argumentExpression).node;
+    if (!t.isNewExpression(node))
+        return undefined;
+    const callee = unwrapJavaScriptExpression(node.callee).node;
+    if (!isUnmodifiedGlobalReference(callee, bindings, "URL") ||
+        !isUnmodifiedImportMetaUrl(argumentNode(node.arguments[1]), bindings))
+        return undefined;
+    const specifier = stringValue(node.arguments[0]);
+    if (specifier === undefined)
+        return undefined;
+    const pathname = stripQueryAndFragment(specifier);
+    // The module URL's scheme and filesystem/origin root are unavailable. Only
+    // relative pathnames can establish a location within the artifact; retain
+    // rooted paths and paths requiring URL text normalization as expressions.
+    // Malformed percent escapes survive HTTP URL parsing but cannot be converted
+    // from a file URL to a Node Worker path. Without the base scheme, keep that
+    // ambiguity unknown; query and fragment bytes do not affect pathname lookup.
+    return pathname.length > 0 &&
+        !pathname.startsWith("/") &&
+        !/%(?![0-9a-f]{2})/iu.test(pathname) &&
+        stripQueryAndFragment(htmlUrlText(specifier)) === pathname
+        ? specifier
+        : undefined;
+};
+const workerConstructorKind = (callee, bindings) => {
+    const node = unwrapJavaScriptExpression(callee).node;
+    const member = t.isMemberExpression(node) &&
+        semanticStaticPropertyName(node.property, node.computed) === "Worker";
+    const root = unwrapJavaScriptExpression(member ? node.object : node).node;
+    if (!t.isIdentifier(root))
+        return undefined;
+    const browserGlobal = member
+        ? ["globalThis", "window", "self"].includes(root.name)
+        : root.name === "Worker";
+    if (browserGlobal && isUnmodifiedGlobalReference(node, bindings, "Worker"))
+        return "browser";
+    const binding = resolveSemanticBindingState(bindings, root, root.name);
+    const [origin] = binding?.directOrigins ?? [];
+    // Named ESM exports and module namespace exports are read-only. Default
+    // imports and CommonJS objects can replace Worker, so their identity is unknown.
+    return binding?.runtimeImport === true &&
+        binding.definitions.length === 1 &&
+        binding.directOrigins.length === 1 &&
+        origin !== undefined &&
+        (origin.specifier === "worker_threads" ||
+            origin.specifier === "node:worker_threads") &&
+        (member
+            ? origin.importedPath.length === 0
+            : origin.importedPath.length === 1 && origin.importedPath[0] === "Worker")
+        ? "node"
+        : undefined;
+};
 // Element factories such as jsx("audio", props) and createElement("video",
 // props) carry the HTML media `preload` hint ("none", "metadata", "auto"),
 // which never names an Electron preload script.
@@ -75,41 +165,138 @@ const noteMediaElementPreloads = (node, accumulator) => {
             semanticStaticPropertyName(property.key, property.computed) === "preload")
             accumulator.mediaElementPreloads.add(property);
 };
-const requireCallSpecifier = (node, name, moduleRequireName) => {
-    if (name === "require" || name.endsWith(".require"))
-        return { specifier: argumentValue(node.arguments[0]) };
-    if (name === "__webpack_require__" || name === moduleRequireName)
-        return { specifier: argumentValue(node.arguments[0]) };
-    if (name === "__webpack_require__.bind" ||
-        (moduleRequireName !== null && name === `${moduleRequireName}.bind`))
-        return { specifier: argumentValue(node.arguments[1]) };
+const requireCallSpecifier = (node, bindings, context) => {
+    const bareRequire = t.isIdentifier(node.callee, { name: "require" });
+    if (bareRequire) {
+        const loader = semanticRequireLoaderAt(node, bindings, context.accumulator.factoryRequireBindingIds);
+        if (loader === "local")
+            return null;
+        if (loader === "unknown")
+            context.accumulator.unknownFindings += 1;
+        return {
+            specifier: loader === "unknown" ? undefined : argumentValue(node.arguments[0]),
+        };
+    }
+    const factoryLoader = semanticFactoryRequireLoaderAt(node, bindings, context.accumulator.factoryRequireBindingIds);
+    if (factoryLoader === "factory-loader")
+        return {
+            specifier: argumentValue(node.arguments[t.isMemberExpression(unwrapJavaScriptExpression(node.callee).node) ||
+                t.isOptionalMemberExpression(unwrapJavaScriptExpression(node.callee).node)
+                ? 1
+                : 0]),
+        };
+    if (factoryLoader === "unknown") {
+        context.accumulator.unknownFindings += 1;
+        return { specifier: undefined };
+    }
     return null;
 };
-const chunkLoadSpecifier = (node, name, moduleRequireName) => {
-    if (name !== "__webpack_require__.e" &&
-        (moduleRequireName === null || name !== `${moduleRequireName}.e`))
+const chunkLoadSpecifier = (node, bindings, context) => {
+    const loader = semanticFactoryLoaderMemberAt(node, bindings, context.accumulator.factoryRequireBindingIds, "e");
+    if (loader === undefined)
         return null;
+    if (loader === "unknown")
+        return { specifier: undefined };
     return { specifier: prefixedArgument("chunk:", node.arguments[0]) };
 };
-const vitePreloadDependencySpecifiers = (source, node, name) => {
-    if (name !== "__vite__mapDeps" || !t.isArrayExpression(node.arguments[0]))
+const vitePreloadDependencySpecifiers = (node, name, table, bindings) => {
+    if (name !== "__vite__mapDeps" ||
+        table === null ||
+        !t.isArrayExpression(node.arguments[0]))
         return [];
-    const indexes = node.arguments[0].elements.flatMap((element) => t.isNumericLiteral(element) ? [element.value] : []);
-    if (indexes.length !== node.arguments[0].elements.length)
-        return [];
-    const table = vitePreloadDependencyTable(source);
-    return indexes.flatMap((index) => table[index] ?? []);
+    const indexes = node.arguments[0].elements;
+    // Explicit cache overrides change which table the helper reads. Retain the
+    // call slots as unknown unless every override is statically undefined.
+    if (!node.arguments
+        .slice(1)
+        .every((argument) => isExplicitDefaultArgument(argument, bindings)))
+        return indexes.map(() => undefined);
+    return indexes.map((element) => {
+        if (element === null || !t.isNumericLiteral(element))
+            return undefined;
+        const index = element.value;
+        return Number.isSafeInteger(index) && index >= 0 ? table[index] : undefined;
+    });
 };
-const vitePreloadDependencyTable = (source) => {
-    const match = /\.\s*f\s*\|\|\s*\(\s*[^)]*?\.f\s*=\s*\[([\s\S]*?)\]\s*\)/u.exec(source);
-    const body = match?.[1];
-    if (body === undefined)
+const isExplicitDefaultArgument = (argument, bindings) => {
+    if (!t.isNode(argument))
+        return false;
+    const value = unwrapJavaScriptExpression(argument).node;
+    return ((t.isUnaryExpression(value) && value.operator === "void") ||
+        (t.isIdentifier(value, { name: "undefined" }) &&
+            isUnmodifiedGlobalReference(value, bindings, "undefined")));
+};
+/** Index the canonical Vite helper's cache initializer from parsed syntax. */
+export const indexVitePreloadDependencyTable = (program) => {
+    const helpers = [];
+    traverseJavaScriptAst(program, {
+        enter: (node) => {
+            if (t.isFunctionDeclaration(node) && node.id?.name === "__vite__mapDeps")
+                helpers.push(node);
+            else if (t.isVariableDeclarator(node) &&
+                t.isIdentifier(node.id, { name: "__vite__mapDeps" })) {
+                const init = node.init;
+                if (t.isFunctionExpression(init) || t.isArrowFunctionExpression(init))
+                    helpers.push(init);
+            }
+        },
+    });
+    if (helpers.length !== 1)
+        return null;
+    const helper = helpers[0];
+    if (helper === undefined)
+        return null;
+    const mapParameter = helper.params[1];
+    const mapIdentifier = t.isAssignmentPattern(mapParameter)
+        ? mapParameter.left
+        : mapParameter;
+    if (!t.isIdentifier(mapIdentifier))
+        return [];
+    const tables = [];
+    traverseJavaScriptAst(helper, {
+        skip: (node) => t.isFunction(node),
+        enter: (node) => {
+            if (t.isAssignmentExpression(node) &&
+                node.operator === "=" &&
+                (t.isMemberExpression(node.left) ||
+                    t.isOptionalMemberExpression(node.left)) &&
+                t.isIdentifier(node.left.object, { name: mapIdentifier.name }) &&
+                semanticStaticPropertyName(node.left.property, node.left.computed) ===
+                    "f" &&
+                t.isArrayExpression(node.right))
+                tables.push(node.right);
+        },
+    });
+    if (tables.length !== 1)
+        return [];
+    const table = tables[0];
+    if (table === undefined)
         return [];
-    return [
-        ...body.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gu),
-    ].map((literal) => literal[1] ?? literal[2] ?? "");
+    const dependencies = table.elements.map((element) => element === null || t.isSpreadElement(element)
+        ? undefined
+        : stringValue(element));
+    let escapedOrMutated = false;
+    traverseJavaScriptAst(program, {
+        skip: (node) => node === helper,
+        enter: (node, parent) => {
+            if (!t.isIdentifier(node, { name: "__vite__mapDeps" }))
+                return;
+            if ((parent === helper &&
+                t.isFunctionDeclaration(parent) &&
+                parent.id === node) ||
+                (t.isVariableDeclarator(parent) &&
+                    parent.init === helper &&
+                    parent.id === node))
+                return;
+            if ((t.isCallExpression(parent) || t.isOptionalCallExpression(parent)) &&
+                parent.callee === node)
+                return;
+            escapedOrMutated = true;
+        },
+    });
+    return escapedOrMutated ? dependencies.map(() => undefined) : dependencies;
 };
-const inspectEndpointCall = (node, name, first, context) => {
+const inspectEndpointCall = (node, name, first, context, bindings) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (route && first !== undefined)
         addEndpoint(context, {
@@ -118,29 +305,228 @@ const inspectEndpointCall = (node, name, first, context) => {
             value: first,
             mechanism: `call:${name}`,
         });
+    if (isKnownNetworkRequest(node, bindings)) {
+        const target = argumentNode(node.arguments[0]);
+        if (target === undefined)
+            return;
+        const literal = stringValue(target);
+        if (literal !== undefined) {
+            addEndpoint(context, {
+                node,
+                kind: "network",
+                value: literal,
+                mechanism: `call:${name}`,
+            });
+            return;
+        }
+        const reference = requestReferenceNode(target);
+        const unwrapped = unwrapJavaScriptExpression(reference).node;
+        if (t.isIdentifier(unwrapped) ||
+            t.isMemberExpression(unwrapped) ||
+            t.isOptionalMemberExpression(unwrapped)) {
+            context.accumulator.pendingNetworkCalls.push({ node, name });
+            return;
+        }
+        addPartialNetworkEndpoint(context, node, name, target);
+        return;
+    }
+    // A local or shadowed function with a familiar network name is not a known
+    // browser request API. Do not let the literal fallback turn it into one.
+    if (isNetworkRequestSpelling(name))
+        return;
+    if (first !== undefined && /(?:^|\.)(?:get|delete)$/u.test(name)) {
+        // Apply existing literal exclusions before requesting whole-source alias
+        // mutation facts. Inline receivers and unbound names need no such index.
+        if (endpointArgumentHelper(name, node.arguments, node.callee, context.openReceiverFacts?.get(node.start ?? -1)) === undefined)
+            return;
+        const mapLookup = isIntrinsicMapLookup(node, bindings);
+        if (mapLookup === true)
+            return;
+        if (mapLookup === undefined) {
+            context.accumulator.pendingNetworkCalls.push({ node, name });
+            return;
+        }
+    }
+    inspectLiteralEndpointCall(node, name, context);
+};
+const inspectLiteralEndpointCall = (node, name, context) => {
     const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
     const endpoint = endpointArgumentHelper(name, node.arguments, node.callee, receiverFact);
     if (endpoint !== undefined)
         addEndpoint(context, {
             node,
             kind: "network",
-            value: endpoint,
+            value: endpoint.value,
             mechanism: `call:${name}`,
+            ...(endpoint.kind === "candidate" ? { interpretation: "candidate" } : {}),
         });
 };
+const isNetworkRequestSpelling = (name) => name === "fetch" ||
+    name === "WebSocket" ||
+    name === "EventSource" ||
+    name === "sendBeacon" ||
+    name === "window.fetch" ||
+    name === "globalThis.fetch" ||
+    name === "self.fetch" ||
+    name === "navigator.sendBeacon";
+/** Confirm that the call resolves to a built-in network API at this source site. */
+const isKnownNetworkRequest = (node, bindings) => {
+    if ((t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
+        isUnmodifiedGlobalReference(node.callee, bindings, "fetch"))
+        return true;
+    if (t.isNewExpression(node) &&
+        (isUnmodifiedGlobalReference(node.callee, bindings, "WebSocket") ||
+            isUnmodifiedGlobalReference(node.callee, bindings, "EventSource")))
+        return true;
+    return ((t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
+        isUnmodifiedGlobalReference(node.callee, bindings, [
+            "navigator",
+            "sendBeacon",
+        ]));
+};
+/** Finish queued targets after shared member-mutation facts are indexed. */
+export const finishPartialNetworkEndpoints = (context, bindings, index) => {
+    for (const { node, name } of context.accumulator.pendingNetworkCalls) {
+        if (!isKnownNetworkRequest(node, bindings)) {
+            if (!isIntrinsicMapLookup(node, bindings, index))
+                inspectLiteralEndpointCall(node, name, context);
+            continue;
+        }
+        const target = argumentNode(node.arguments[0]);
+        if (target === undefined)
+            continue;
+        const resolved = resolvedRequestTarget(target, node, bindings, index);
+        if (resolved !== undefined)
+            addEndpoint(context, {
+                node,
+                kind: "network",
+                value: resolved,
+                mechanism: `call:${name}`,
+            });
+        else
+            addPartialNetworkEndpoint(context, node, name, target);
+    }
+    context.accumulator.pendingNetworkCalls.length = 0;
+    context.accumulator.endpoints.sort((left, right) => left.offset - right.offset);
+};
+const addPartialNetworkEndpoint = (context, node, name, target) => addEndpoint(context, {
+    node,
+    kind: "network",
+    // Partial values preserve the original expression text, byte for byte.
+    value: sourceSlice(context.source, target),
+    mechanism: `call:${name}`,
+    resolution: "partial",
+});
+const resolvedRequestTarget = (node, site, bindings, index) => {
+    const reference = requestReferenceNode(node);
+    // A toString result is selected before the enclosing request invocation.
+    const expression = unwrapJavaScriptExpression(node).node;
+    const capture = reference === expression ? site : expression;
+    if (index.referenceMayHaveChangedAt(capture, reference))
+        return undefined;
+    if (!requestInitializerPrecedesSite(reference, capture, bindings, index))
+        return undefined;
+    const evaluated = evaluateSemanticExpression(node, bindings);
+    if (evaluated.status === "literal" && typeof evaluated.value === "string")
+        return evaluated.value;
+    return urlObjectRequestTarget(node, capture, bindings, index);
+};
+const requestInitializerPrecedesSite = (reference, site, bindings, index) => {
+    const binding = index.bindingForReferenceAt(reference);
+    const initializer = semanticStableInitializer(binding, bindings);
+    return (initializer !== undefined &&
+        semanticTopLevelEffectFollowsCapture(initializer.node, site, bindings.parentsByNode));
+};
+const requestReferenceNode = (node) => {
+    const target = unwrapJavaScriptExpression(node).node;
+    if ((t.isCallExpression(target) || t.isOptionalCallExpression(target)) &&
+        target.arguments.length === 0) {
+        const callee = unwrapJavaScriptExpression(target.callee).node;
+        if ((t.isMemberExpression(callee) || t.isOptionalMemberExpression(callee)) &&
+            semanticStaticPropertyName(callee.property, callee.computed) ===
+                "toString")
+            return unwrapJavaScriptExpression(callee.object).node;
+    }
+    return target;
+};
+/** Resolve an immutable URL object or alias only while shared effects say it is unchanged. */
+const urlObjectRequestTarget = (node, site, bindings, index, seen = new Set()) => {
+    let target = unwrapJavaScriptExpression(node).node;
+    if ((t.isCallExpression(target) || t.isOptionalCallExpression(target)) &&
+        target.arguments.length === 0) {
+        const callee = unwrapJavaScriptExpression(target.callee).node;
+        if ((t.isMemberExpression(callee) || t.isOptionalMemberExpression(callee)) &&
+            semanticStaticPropertyName(callee.property, callee.computed) ===
+                "toString")
+            target = unwrapJavaScriptExpression(callee.object).node;
+    }
+    if (!t.isIdentifier(target) || index.referenceMayHaveChangedAt(site, target))
+        return undefined;
+    const binding = index.bindingForReferenceAt(target);
+    if (binding === undefined || seen.has(binding.bindingId))
+        return undefined;
+    seen.add(binding.bindingId);
+    const stable = semanticStableInitializer(binding, bindings);
+    if (stable === undefined ||
+        !semanticTopLevelEffectFollowsCapture(stable.node, site, bindings.parentsByNode))
+        return undefined;
+    const initializer = stable.node;
+    if (initializer === undefined)
+        return undefined;
+    const initialized = unwrapJavaScriptExpression(initializer).node;
+    if (t.isIdentifier(initialized))
+        return urlObjectRequestTarget(initialized, site, bindings, index, seen);
+    if (!t.isNewExpression(initialized))
+        return undefined;
+    if (!isUnmodifiedGlobalReference(initialized.callee, bindings, "URL"))
+        return undefined;
+    if (["URL", "Object"].some((owner) => ["toString", "valueOf"].some((method) => bindings.ambientWrites.covers(["global", owner, "prototype", method]))))
+        return undefined;
+    const input = stringValue(initialized.arguments[0]);
+    if (input === undefined)
+        return undefined;
+    if (initialized.arguments.length === 1) {
+        try {
+            return new URL(input).href;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (initialized.arguments.length !== 2)
+        return undefined;
+    const base = stringValue(initialized.arguments[1]);
+    if (base === undefined)
+        return undefined;
+    try {
+        return new URL(input, base).href;
+    }
+    catch {
+        return undefined;
+    }
+};
 /** Record tRPC procedures, tRPC link URLs and named GraphQL operations. */
 export const inspectRpcNode = (node, context) => {
     const rpc = context.rpcScan.inspect(node);
     if (rpc !== undefined)
         addEndpoint(context, { node, kind: "network", ...rpc });
 };
+/** Resolve deferred Source bodies after their document owners have been seen. */
+export function* finishRpcScanSteps(context) {
+    for (const rpc of context.rpcScan.finish()) {
+        if (rpc !== undefined)
+            addEndpoint(context, { kind: "network", ...rpc });
+        yield;
+    }
+}
 export const inspectRouteProperty = (node, context) => {
     const key = semanticStaticPropertyName(node.key, node.computed);
-    if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
+    const value = stringValue(node.value);
+    if ((key === "path" || key === "route") && value !== undefined)
         addEndpoint(context, {
             node,
             kind: "route",
-            value: node.value.value,
+            value,
             mechanism: `property:${key}`,
         });
 };
@@ -167,6 +553,10 @@ export const inspectRoleProperty = (node, context) => {
     });
 };
 const inspectStorageCall = (node, name, first, context) => {
+    if (name === "Database" || name.endsWith(".Database")) {
+        context.accumulator.pendingSqliteCalls.push({ node, name });
+        return;
+    }
     const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
     const storage = receiverFact === "local" ||
         receiverFact === "local-indexed-db" ||
@@ -192,6 +582,46 @@ const inspectStorageCall = (node, name, first, context) => {
         },
     });
 };
+/** Constructor spelling selects a candidate; source provenance owns certainty. */
+export const finishSqliteStorageCalls = (context, bindings, index) => {
+    for (const { node, name } of context.accumulator.pendingSqliteCalls) {
+        const callee = unwrapJavaScriptExpression(node.callee).node;
+        const provenance = evaluateSemanticExpressionProvenance(callee, bindings);
+        const changed = index.referenceMayHaveChangedAt(node, callee);
+        if (!changed && t.isIdentifier(callee) && provenance.status === "local")
+            continue;
+        const origin = provenance.status === "module" ? provenance.origins[0] : undefined;
+        const path = origin?.importedPath;
+        const imported = origin?.resolutionMode !== "require";
+        const known = !changed &&
+            origin !== undefined &&
+            ((origin.specifier === "better-sqlite3" &&
+                ((origin.resolutionMode === "require" && path?.length === 0) ||
+                    (imported && path?.length === 1 && path[0] === "default"))) ||
+                (origin.specifier === "sqlite3" &&
+                    ((path?.length === 1 && path[0] === "Database") ||
+                        (imported &&
+                            path?.length === 2 &&
+                            (path[0] === "default" || path[0] === "*") &&
+                            path[1] === "Database"))));
+        const first = stringValue(node.arguments[0]);
+        addLocatedFinding(context, {
+            collection: context.accumulator.storage,
+            key: `storage\0sqlite\0${known ? "api" : "candidate"}\0${first ?? ""}`,
+            node,
+            value: {
+                kind: "sqlite",
+                name: first ?? null,
+                mechanism: `call:${name}`,
+                ...(known ? {} : { interpretation: "candidate" }),
+                module_key: null,
+                location: range(node),
+            },
+        });
+    }
+    context.accumulator.pendingSqliteCalls.length = 0;
+    context.accumulator.storage.sort((left, right) => left.offset - right.offset);
+};
 export const addReference = (context, input) => {
     const specifier = input.specifier ?? null;
     const reference = specifier === null
@@ -214,12 +644,20 @@ export const addReference = (context, input) => {
 };
 const addEndpoint = (context, input) => addLocatedFinding(context, {
     collection: context.accumulator.endpoints,
-    key: `endpoint\0${input.kind}\0${input.value}`,
+    key: `endpoint\0${input.kind}\0${input.interpretation ?? "literal"}\0${input.resolution ?? "exact"}\0${input.value}`,
     node: input.node,
     value: {
         kind: input.kind,
-        value: sanitizeEndpointCandidate(input.value),
+        value: input.resolution === "partial"
+            ? input.value
+            : sanitizeEndpointCandidate(input.value),
         mechanism: input.mechanism,
+        ...(input.interpretation === undefined
+            ? {}
+            : { interpretation: input.interpretation }),
+        ...(input.resolution === undefined
+            ? {}
+            : { resolution: input.resolution }),
         module_key: null,
         location: range(input.node),
     },
@@ -235,7 +673,9 @@ export const addSourceMapDirectives = (source, comments, accumulator) => {
             end === undefined ||
             end === null)
             continue;
-        const commentSource = source.slice(start, end);
+        // The parser owns comment boundaries. Exclude only the closing block
+        // delimiter; an asterisk elsewhere remains part of the declared URL.
+        const commentSource = source.slice(start, comment.type === "CommentBlock" ? end - 2 : end);
         if (!(commentSource.startsWith("//") || commentSource.startsWith("/*")) ||
             !(commentSource[2] === "#" || commentSource[2] === "@"))
             continue;
@@ -258,7 +698,7 @@ export const addSourceMapDirectives = (source, comments, accumulator) => {
         if (urlOffset === -1)
             continue;
         const declaredStart = equalsStart + 1 + urlOffset;
-        const terminator = commentSource.slice(declaredStart).search(/[\s*]/u);
+        const terminator = commentSource.slice(declaredStart).search(/\s/u);
         const declaredEnd = terminator === -1 ? commentSource.length : declaredStart + terminator;
         if (declaredEnd === declaredStart)
             continue;